Keeping your website secure means staying alert and responding quickly when new threats emerge. Today, our team addressed CVE-2026-109619, a critical security flaw in PHP—the software that powers many websites—alongside the related vulnerability CVE-2026-109618.
In plain terms, these flaws could allow an attacker to send specially crafted requests to a vulnerable server and potentially run unauthorized commands. That could put website content, data, and availability at risk. PHP security advisory
Our team received an alert when the issue was announced and began reviewing its implications. At 8:00 a.m. Eastern on October 21, we connected with CloudLinux and cPanel to determine the recommended response. Details were still developing, and we continued monitoring vendor guidance and the availability of updates for our hosting environment.
While we awaited the appropriate software patch, Imunify360 introduced protective firewall rules designed to block known attack patterns. We ensured those protections were in place to help keep customer sites online and reduce exposure while a permanent fix was prepared. These rules provided an interim layer of protection; updating the affected software remained essential. CloudLinux response updates
At 6:56 p.m. Eastern Daylight Time (22:56 UTC), we applied the hardened PHP patch, minutes after it became available for our environment.
This response reflects our ongoing approach to security: monitor emerging threats, work closely with our premium technology partners, and apply protections promptly as reliable fixes become available.
Attackers are increasingly using AI to accelerate their work and carry out attacks at greater scale, making timely monitoring and response even more important. Microsoft’s research on AI-enabled threats
We remain vigilant and work alongside trusted providers, including CloudLinux, cPanel, and Imunify360, to help protect your website. We also maintain a rigorous backup policy to support recovery if an incident gets past preventive safeguards. Monitoring, prevention, and recovery planning remain priorities for our team every day.
